Tag Info

Hot answers tagged

216

Just because they won't use it, doesn't mean someone else won't find it and use it. A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money ...


85

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's ...


44

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone ...


43

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2]. But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ...


32

It is legal to tell them about the bug, giving them a detailed description of the bug and how you came across it. What is unpredictable is the company's reaction. It could vary to something such as them sending you a reward/small gift (has happened to me), to them trying to prosecute you as a criminal (tipping them off anonymously could help with this ...


27

In Canada it appears as though that you're safe ... for now. Anywhere else, it depends on whether by "search bugs" you mean to find exploits on someone's site that might violate their Terms and Conditions of usage for the website (Eg. Penetration Testing). There are a couple of different ways this could go, depending on the reaction of the person who ...


27

No. You should always assume that the attacker knows everything. Security by obscurity is considered bad practice by most non-govt developers and architects. The obstacle it provides is minimal, and if something is kept secret, it may be so to hide a flaw. Kerckhoffs's principle is important to look at. Edit: This answer discusses security by obscurity in ...


27

The notion that open source software is inherently more secure than closed source software -- or the opposite notion -- is nonsense. And when people say something like that it is often just FUD and does not meaningfully advance the discussion. To reason about this you must limit the discussion to a specific project. A piece of software which scratches a ...


26

For the future, there is one critical thing you should be doing: Provide an easy way for people to report security bugs to you. I took a look at the web page for your application, and I noticed it doesn't seem to list any way for a security researcher to contact you with a report of a security vulnerability. There is no email address to report security ...


26

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself. Imagine this scenario: You inform management about the backdoor. Now they know you know. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin. Your management finds out about Evil Hacker ZmEu's pastebin. Your ...


22

It's ok, people will still buy the iPhones your company makes - your secret is safe. ;) If it was my workplace, where I'm employed as a security analyst, I'd accept that my job is to identify and communicate risk; it's up to the business to accept the risk. I can not accept risk personally, so my only real option is to ensure that I've communicated the ...


21

If you want to do a good turn, you can report the malicious site to several centralized sources. There are some companies that maintain centralized lists of malicious web sites, and you can report the web sites to those companies. Here are some places you can report phishing sites: Report a phishing site to Google Report a phishing site to Symantec ...


20

Before the smartphone area it was a standard feature of all mobile phone to have backdoors. The GSM protocol allowed the base station to update the phone software. http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html is a good talk about how crazy the security scheme has been. As far as I know no one of the companies involved in creating GSM got ...


19

Maintained software is more secure than software which is not. Maintenance effort being, of course, relative to the complexity of said software and the number (and skill) of people who are looking at it. The theory behind opensource systems being more secure is that there are "many eyes" which look at the source code. But this depends quite a lot on the ...


19

Don't provide any information to anyone unless its absolutely necessary. You should set expose_php=off in your PHP.ini. This tells PHP not to expose the "x-powered-by" HTTP header as well as the strange quarks that can be used to identify it. You should also set display_errors=Off which could be used to identify PHP as well as error-based vulnerabilities ...


16

You should let the developer(s) know privately so that they have a chance to fix it. After that, if and when you go public with the vulnerability, you should allow the developer enough time to fix the problem and whoever is exposed to it enough time to upgrade their systems. Personally, I would allow the developer to make the announcement in a security ...


13

In the 'white' sense, the most well known companies that pay researchers to buy vulnerabilities or exploits are: Zero Day Initiative (ZDI) by TippingPoint: http://www.zerodayinitiative.com/ iDefense http://labs.idefense.com/vcp/ iSight https://gvp.isightpartners.com SecuriTeam http://www.beyondsecurity.com/ssd.html Netragard ...


12

For legal advice you need to seek a lawyer. In some countries it is already illegal to do a "test" login with an account that does not belong to you. What I would do? If the IT-department does not answer and does not fix the issue, you should try to reach other people at the company, especially upper management, public relation, customer relation, high ...


11

I think the premises that most use to differentiate between closed and open source are pretty well defined. Many of those are listed here, both have their advocates. Unsurprisingly the proponents for Closed Source are those that sell it. The proponents for Open Source have also made it a nice and tidy business (beyond a few who have taken it on as a ...


11

You have a professional responsibility and an ethical responsibility to ensure this is addressed, IMO. And you've stepped into a minefield. Protect yourself. Watch your step. Go slow. Think defense-in-depth. I successfully solicited a whistleblower, who has been able to maintain anonymity. The solicitation included advice on maintaining anonymity; ...


11

It is unlikely that you can legally make money from this bug. If you are considering some scheme to make lots of money from it: step away, take some time off. There is a significant risk that you will be prosecuted for hacking or for extortion if you try to demand compensation for reporting the vulnerability. Note that in the US, hacking is illegal. The ...


11

Look up their DNS record with whois, and contact their listed admin. Also, contact their hosting provider.


10

Many websites have a disclaimer that forbids you to conduct any security tests on their website. Therefore, if you really want to do it, I suggest that you report the bug anonymously and like others said, make sure to mention you've only done this to help them.


10

Personally I think Responsible disclosure seems to be the best way to go from an ethical point and worked well for Dan Kaminsky revealing the details of the DNS cache poisoning vulnerability. But it all depends greatly on the company or group you are dealing with and also the user base that it will affect.


10

I like a few of the answers here, but thought to mention another possibility - disclosure through a legal representative. I'm not saying this might be worth your trouble, but can work in a situation where you don't want to disclose any information that could lead to identifying you (inspection through server logs for matching activity as @AbsoluteƵERØ ...


10

If your compliance or regulatory body is perceived as PCI, you are incorrect. They make the rules and guidelines, but in this situation it is your companies' acquiring bank (the bank that issued your merchant number and processes your payments). What is the volume of cardholder data that is being taken off premises or thrown away without shredding? From ...


10

Treat it as a security vulnerability you have discovered and report it to to, for example, CVE. Anonymously if you wish.


10

Your reaction is sound, and on a gut instinct level means that you care about one or more of: your customers' privacy, your company's public image, your codebase's quality, your own skin. In my workplace, I would be senior enough to know it a security bug (and not there by company intent, or mandate from the government) - and remove it. It sounds like this ...


9

Even if such a statistic existed, it would be meaningless because these attacks don't occur as a result of random chance. Your chances of being "hacked" rise dramatically if: You don't secure the application properly (SQL Injection being the most obvious, and sadly still commonplace vulnerability; others include plain-text passwords, XSS/XSRF, and not ...



Only top voted, non community-wiki answers of a minimum length are eligible